We run in a windows server 2003 domain. Our ftp 'server' is a separate xp box, that pretty much is all it handles is the ftp. So our firewall forwards ftp ports to that box.
Filezilla (ftp software) automatically temporarily bans an IP address after x amount of failed attempts in x minutes.
We use a common username and password, so there isn't an 'anonymous' login, and everything is 'public'. But someone still has to contact us to get the username and password.
A few clients have their own username and password, and their folders are private.